fadenstack 0.4.2__py3-none-any.whl

faden_cli/bundle/shared/grafana/provisioning/dashboards/dashboard.yml

@@ -0,0 +1,10 @@
+apiVersion: 1
+providers:
+  - name: fadenstack Provisioned
+    orgId: 1
+    folder: Fadenstack
+    type: file
+    disableDeletion: false
+    editable: true
+    options:
+      path: /etc/grafana/provisioning/dashboards/json

faden_cli/bundle/shared/grafana/provisioning/dashboards/json/faden-overview.json

@@ -0,0 +1,211 @@
+{
+  "id": null,
+  "uid": "faden-overview",
+  "title": "fadenstack Overview",
+  "tags": ["fadenstack", "overview"],
+  "timezone": "browser",
+  "schemaVersion": 39,
+  "version": 1,
+  "refresh": "30s",
+  "style": "dark",
+  "editable": true,
+  "time": {
+    "from": "now-6h",
+    "to": "now"
+  },
+  "timepicker": {
+    "refresh_intervals": ["5s", "10s", "30s", "1m", "5m"],
+    "time_options": ["15m", "1h", "6h", "12h", "24h", "7d"]
+  },
+  "templating": {
+    "list": []
+  },
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "panels": [
+    {
+      "id": 1,
+      "title": "Log Lines / 5m",
+      "type": "timeseries",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 0
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(count_over_time({job=\"docker\"}[5m]))",
+          "queryType": "range"
+        }
+      ],
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "single"
+        }
+      }
+    },
+    {
+      "id": 2,
+      "title": "Top Containers by Log Volume (5m)",
+      "type": "barchart",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 0
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "topk(10, sum by (container) (count_over_time({container!=\"\"}[5m])))",
+          "queryType": "range"
+        }
+      ],
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "bottom"
+        }
+      }
+    },
+    {
+      "id": 3,
+      "title": "Error Log Rate (5m)",
+      "type": "timeseries",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 0,
+        "y": 8
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(count_over_time({job=\"docker\"} |= \"error\" [5m]))",
+          "queryType": "range"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "logs"
+        },
+        "overrides": []
+      }
+    },
+    {
+      "id": 4,
+      "title": "Warning Log Rate (5m)",
+      "type": "timeseries",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 8,
+        "y": 8
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(count_over_time({job=\"docker\"} |= \"warn\" [5m]))",
+          "queryType": "range"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "logs"
+        },
+        "overrides": []
+      }
+    },
+    {
+      "id": 5,
+      "title": "Recent Error Logs",
+      "type": "logs",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 16,
+        "y": 8
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "{job=\"docker\"} |= \"error\"",
+          "queryType": "range"
+        }
+      ],
+      "options": {
+        "showTime": true,
+        "wrapLogMessage": true,
+        "enableLogDetails": true
+      }
+    },
+    {
+      "id": 6,
+      "title": "Recent All Logs",
+      "type": "logs",
+      "datasource": {
+        "type": "loki",
+        "uid": "loki"
+      },
+      "gridPos": {
+        "h": 10,
+        "w": 24,
+        "x": 0,
+        "y": 16
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "{job=\"docker\"}",
+          "queryType": "range"
+        }
+      ],
+      "options": {
+        "showTime": true,
+        "wrapLogMessage": true,
+        "enableLogDetails": true,
+        "prettifyLogMessage": false
+      }
+    }
+  ]
+}

faden_cli/bundle/shared/grafana/provisioning/datasources/ds.yaml

@@ -0,0 +1,9 @@
+apiVersion: 1
+datasources:
+  - name: Loki
+    uid: loki
+    type: loki
+    access: proxy
+    orgId: 1
+    url: http://loki:3100
+    isDefault: true

faden_cli/bundle/shared/grafana/provisioning/datasources/prometheus.yaml

@@ -0,0 +1,15 @@
+# Prometheus datasource for LLM runtime (vLLM) metrics.
+#
+# The uid `prometheus` is load-bearing: the generated per-runtime
+# dashboards (vllm-rt-*) and the reference dashboard from
+# dev/vllm-dgx-monitoring all reference
+# {"type": "prometheus", "uid": "prometheus"}.
+apiVersion: 1
+datasources:
+  - name: Prometheus
+    uid: prometheus
+    type: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    isDefault: false
+    editable: true

faden_cli/bundle/shared/initdb/01-init.sql

@@ -0,0 +1,32 @@
+-- Run by Postgres once, when its data volume is created empty.
+--
+-- The databases only, and no logins: every service connects as
+-- POSTGRES_USER with POSTGRES_PASSWORD, which `faden deploy` writes into
+-- .env at random for each install. This script used to make two more logins
+-- with fixed passwords (llm_user, faden_backend), the same on every install,
+-- one of them able to read every backend table. Nothing in an install uses
+-- them: `faden deploy` and `faden upgrade` switch them off on an install that
+-- has them, and the development stack makes the one it needs itself
+-- (`faden dev up`).
+
+CREATE EXTENSION IF NOT EXISTS vector;
+
+-- DB for Langfuse
+CREATE DATABASE langfuse;
+-- DB for your RAG service
+CREATE DATABASE rag;
+-- DB for Fadenstack backend
+CREATE DATABASE faden_backend;
+-- DB for llm gateway metadata/audit
+CREATE DATABASE faden_gateway;
+-- DB for MCP tool registry
+CREATE DATABASE faden_mcp;
+-- DB for Skills Registry
+CREATE DATABASE faden_skills;
+
+-- Optional: enable pgvector in rag DB
+\connect rag
+CREATE EXTENSION IF NOT EXISTS vector;
+
+\connect faden_backend
+CREATE EXTENSION IF NOT EXISTS vector;

faden_cli/bundle/shared/loki/local-config.yaml

@@ -0,0 +1,32 @@
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+
+common:
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2024-01-01
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+limits_config:
+  retention_period: 168h
+
+# No usage reports to Grafana Labs (on by default).
+analytics:
+  reporting_enabled: false

faden_cli/bundle/shared/nginx/locations.conf

@@ -0,0 +1,245 @@
+# Fadenstack — the routes behind the front door.
+#
+# Shared by the plain-HTTP server (nginx.conf) and the HTTPS server
+# (nginx-tls.conf), which include this file; select-config.sh decides
+# which of the two runs. Every upstream is a Docker service name and is
+# re-resolved, so a restarted container needs no nginx restart.
+#
+# Host is passed as the client sent it ($http_host, port included): on
+# ports other than 80/443 ($host drops the port) the backend built its own
+# address without it, and the install line sent machines to the wrong port.
+#
+# X-Forwarded-For is set, not appended to: nginx is the front door, so the
+# address it sees is the client's. Appended, a client could put any address
+# first, and the backend and gateway -- which trust these headers
+# (FORWARDED_ALLOW_IPS=*: nothing but this proxy reaches them from outside)
+# -- took that one for the audit log, rate limits and a machine's address.
+# X-Forwarded-Proto is always nginx's own $scheme for the same reason.
+#
+# Maintenance: while ./nginx/maintenance.flag exists -- put down by
+# `faden upgrade` for its restart, or by `faden maintenance on` -- every
+# route answers 503: pages with maintenance.html, which reloads itself once
+# the platform is back, and the APIs with JSON saying so. /api/health stays
+# open, so the CLI can tell when the backend is up before lifting it. A
+# service that does not answer at all (502/504) gets the same page.
+# X-Faden-Maintenance says which: "maintenance" while the flag is down (the
+# console then reloads into the page), "unavailable" for a service down.
+#
+# Security headers (security-headers.conf) come from the server block; a
+# location with add_header lines of its own includes them again, as nginx
+# would otherwise drop them there.
+
+# ── Maintenance ───────────────────────────────────────────────
+location = /_faden/maintenance.html {
+    internal;
+    set $faden_down unavailable;
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        set $faden_down maintenance;
+    }
+    alias /etc/nginx/faden/maintenance.html;
+    default_type text/html;
+    add_header Cache-Control "no-store" always;
+    add_header Retry-After 30 always;
+    add_header X-Faden-Maintenance $faden_down always;
+    include /etc/nginx/faden/security-headers.conf;
+}
+
+# Why the page is up (the flag's JSON: reason, since, message); 404 when it is
+# not down -- the page then says a service is not answering.
+location = /_faden/maintenance.json {
+    alias /etc/nginx/faden/maintenance.flag;
+    default_type application/json;
+    add_header Cache-Control "no-store" always;
+    include /etc/nginx/faden/security-headers.conf;
+}
+
+location @faden_maintenance_api {
+    set $faden_down unavailable;
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        set $faden_down maintenance;
+    }
+    default_type application/json;
+    add_header Cache-Control "no-store" always;
+    add_header Retry-After 30 always;
+    add_header X-Faden-Maintenance $faden_down always;
+    include /etc/nginx/faden/security-headers.conf;
+    return 503 '{"detail":"Fadenstack is not available right now: it is being updated, under maintenance or restarting. Try again in a minute.","maintenance":"$faden_down"}';
+}
+
+location @faden_maintenance_openai {
+    set $faden_down unavailable;
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        set $faden_down maintenance;
+    }
+    default_type application/json;
+    add_header Cache-Control "no-store" always;
+    add_header Retry-After 30 always;
+    add_header X-Faden-Maintenance $faden_down always;
+    include /etc/nginx/faden/security-headers.conf;
+    return 503 '{"error":{"message":"Fadenstack is not available right now: it is being updated, under maintenance or restarting. Try again in a minute.","type":"service_unavailable","code":"$faden_down"}}';
+}
+
+# Too many sign-in or account requests from one address (rate-limits.conf):
+# JSON, as every other /api answer.
+location @faden_too_many {
+    default_type application/json;
+    add_header Retry-After 60 always;
+    include /etc/nginx/faden/security-headers.conf;
+    return 429 '{"detail":"Too many attempts from this address. Wait a minute, then try again."}';
+}
+
+# ── Backend health (/api/health) ──────────────────────────────
+# Open during maintenance: `faden upgrade` waits on it to lift the flag.
+location = /api/health {
+    set $backend http://faden-backend:8000;
+    proxy_pass $backend;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+# ── Backend API (/api/*) ──────────────────────────────────────
+# The frontend calls /api/* with httponly cookies.
+location /api/ {
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        return 503;
+    }
+    # Only nginx's own: what the backend answers passes as it is.
+    error_page 502 503 = @faden_maintenance_api;
+    # Sign-in, password and token requests, per address; the rest is not
+    # counted (rate-limits.conf).
+    limit_req zone=faden_signin burst=20 nodelay;
+    limit_req zone=faden_account burst=10 nodelay;
+    limit_req zone=faden_refresh burst=200 nodelay;
+    error_page 429 = @faden_too_many;
+    set $backend http://faden-backend:8000;
+    proxy_pass $backend;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # SSE streaming: disable buffering
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 300s;
+
+    # WebSocket support (if needed)
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}
+
+# ── OpenAI-compatible API (/v1/*) ─────────────────────────────
+# External API clients (curl, SDKs) can hit /v1/* through the
+# same origin instead of needing a separate port.
+location /v1/ {
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        return 503;
+    }
+    error_page 502 503 = @faden_maintenance_openai;
+    set $gateway http://faden-gateway:8000;
+    proxy_pass $gateway;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # SSE streaming
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 300s;
+
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}
+
+# ── Gateway static assets (Swagger UI / ReDoc JS+CSS) ───────
+# The gateway serves JS/CSS from /static/docs/*. This location
+# makes those assets reachable via /gateway-static/* so the
+# rewritten HTML (see sub_filter below) can load them.
+location /gateway-static/ {
+    set $gw_static http://faden-gateway:8000;
+    rewrite ^/gateway-static/(.*)$ /static/$1 break;
+    proxy_pass $gw_static;
+    proxy_set_header Host              $http_host;
+}
+
+# ── Gateway API docs (iframe-friendly path) ──────────────────
+# Proxies /gateway-docs/* → faden-gateway /api/*
+location /gateway-docs/ {
+    set $gateway_docs http://faden-gateway:8000;
+    rewrite ^/gateway-docs/(.*)$ /api/$1 break;
+    proxy_pass $gateway_docs;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # Rewrite absolute asset paths in Swagger/ReDoc HTML so they
+    # load through /gateway-static/ and /gateway-docs/ instead of
+    # hitting the backend (/api/) or the frontend catch-all (/static/).
+    proxy_set_header Accept-Encoding "";
+    sub_filter_once off;
+    sub_filter_types text/html;
+    sub_filter '/static/docs/' '/gateway-static/docs/';
+    sub_filter '/api/openapi.json' '/gateway-docs/openapi.json';
+}
+
+# ── Grafana (proxied for remote access) ────────────────────
+# Only for a console session allowed to read observability data: Grafana's
+# anonymous viewer can query any data source (/grafana/api/ds/query), so
+# without this every log and metric was open to whoever reached this port.
+# The console's embedded dashboards send the session cookie and pass.
+location /grafana/ {
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        return 503;
+    }
+    error_page 502 503 504 =503 /_faden/maintenance.html;
+    auth_request /_console_access/grafana;
+    set $grafana http://faden-grafana:3000;
+    proxy_pass $grafana;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # WebSocket support for Grafana Live
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}
+
+location = /_console_access/grafana {
+    internal;
+    set $backend http://faden-backend:8000;
+    proxy_pass $backend/api/admin/observability/grafana-access;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length    "";
+    proxy_set_header Host              $http_host;
+    proxy_set_header Cookie            $http_cookie;
+    proxy_set_header Authorization     $http_authorization;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+# ── Frontend (everything else) ────────────────────────────────
+# React SSR served by react-router-serve.
+location / {
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        return 503;
+    }
+    error_page 502 503 504 =503 /_faden/maintenance.html;
+    set $frontend http://faden-frontend:3000;
+    proxy_pass $frontend;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+}